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Abstract 

The Global Positioning System (GPS) uses a network of satellites to calculate the position of a receiver over time. 
This technology has revolutionised a wide range of safety-critical industries and leisure applications. These systems 
provide diverse benefits; supplementing the users existing navigation skills and reducing the uncertainty that often 
characterises many route planning tasks. GPS applications can also help to reduce workload by automating tasks 
that would otherwise require finite cognitive and perceptual resources. However, the operation of these systems has 
been identified as a contributory factor in a range of recent accidents. Users often come to rely on GPS applications 
and, therefore, fail to notice when they develop faults or when errors occur in the other systems that use the data 
from these systems. Further accidents can stem from the ‘over confidence’ that arises when users assume 
automated warnings will be issued when they stray from an intended route. Unless greater attention is paid to the 
role of trust and interaction in GPS applications then there is a danger that we will see an increasing number of these 
failures as positioning technologies become integral in the functioning of increasing numbers of applications. 

Introduction 


Manual navigation techniques have changed very little over the centuries. Compass-based and celestial navigations 
techniques have been in existence for a long time. Also, commercial and leisure activities often continue to rely on 
dead reckoning, where an initial position is established. The current position is then estimated over time using an 
individual’s or vessel’s speed and direction. The accuracy of dead reckoning calculations depend on the accuracy of 
the speed input and the effects of environmental factors including wind and current. After the Second World War, 
the development of radar and of differential radio signals helped to establish automated approaches to position 
location. These can be thought of as precursors to the satellite based Global Positioning System (GPS) navigation 
techniques that have now become commonplace. 

GPS receivers are now often sold ‘as standard’ with many cars. They are widely used across the maritime 
industries. They are portable and can be attached to Personal Digital Assistants (PDAs); providing continuous 
updates of location information during both work and leisure activities. This growth in the application of GPS 
technologies has fuelled and been fuelled by the use of these systems in safety-critical applications. For example, 
GPS receivers have been integrated into the cockpits of both commercial and general aviation aircraft. However, 
the adoption of GPS-based systems in safety-related applications has led to a number of concerns. The FAA 
recognises that GPS alone cannot satisfy the accuracy and redundancy requirements for navigation imposed across 
the National Airspace System. In consequence, local and wide area augmentation schemes have been proposed and 
are in various stages of implementation. In Europe, more strategic concerns have been raised and plans continue to 
be revised for the creation of an alternate system. 

It is important not to underestimate the complexity of human interaction with GPS applications. For example, the 
US National Oceanic & Atmospheric Administration (NOAA) released a warning in 2002 about some of the 
systemic effects of GPS on navigation behaviour. In particular, they observed that some mariners were more willing 
to follow higher risk routes closer to known hazards because they felt confident in the use of GPS technology to 
accurately identify the position of those hazards. NOAA went on to point out that the increasing accuracy of GPS 
exposes underlying problems in the accuracy of charts and maps. Many of these guides were developed using less 
accurate fixes than those provided using GPS technology. It was argued that “the prudent navigator should pass 
charted hazards such as shoals or isolated dangers with utmost caution, no matter what navigational method is used” 
[ 6 ], 


Most of the concerns over the integration of GPS in safety related systems have focussed on technical and 
infrastructure issues. These include potential disruption to services from unintentional interference. Studies have 
been conducted to exclude or minimise the impact of very high frequency (VHF) radio, over the-horizon (OTH) 
military radar, and broadcast television. There is also growing concern over the vulnerability of navigation tools to 
external attack. One recent study described how a $300 jammer could cause the sudden loss of GPS signal (John 
Hopkins). In the most critical scenario, this might cause an aircrew to abort a Category III precision approach. 
However, many existing systems would use interpolation and dead reckoning so that performance degradation 
would be extremely limited immediately after a signal was lost. Arguably greater concern centres on longer term 
disruption to GPS signals in future scenarios in which these applications become more tightly integrated with Air 
Traffic Management services. 

Such concerns are shaping the future application of GPS technology but these systems have already been implicated 
in a number of accidents where the underlying technology worked as intended. In many of these mishaps, the 
primary cause was identified as human error. Partly in consequence, investigatory agencies have issued general 
advice on the use of GPS technology. For instance, the New Zealand Maritime agency has argued that: “GPS 
derived positions are a useful tool in determining a vessels position but should be used in conjunction with all other 
means of position fixing at the navigators disposal. The temptation to push a button to obtain such data and not 
utilize more labour intensive, traditional methods of position fixing is, to put it bluntly, bad seamanship that puts 
vessels and their crew at risk. Maritime New Zealand is concerned at what appears to be a growing tendency for 
mariners to place excessive reliance on GPS generated data in place of traditional methods of navigation and issues 
a strong warning against such practise” [2]. 

Much of this important advice is focussed on the recommendations that emerge from particular incidents. There 
have been few attempts to gather together the lessons that can derived from a number of different mishaps across a 
range of different industries. The following pages, therefore, provide a sampling of recent accidents in the aviation 
and maritime industries in which it is argued that interaction with GPS technology either triggered or exacerbated 
various forms of operator failure. 


The Operational Benefits of Interactive GPS 

The benefits of GPS and associated technology can be illustrated by the extent to which they have become 
integrated into a number of safety-critical industries. For example, a recent accident report described the standard 
navigational aids on board a fishing vessel equipped for a crew of three; these included a radar, an echo sounder, a 
watch keepers alarm and an autopilot. The fishing vessel also carried two different GPS plotters and a GPS receiver 
[1]. The significance of this equipment can also be illustrated by the consequences that can arise when it is used 
incorrectly. The investigation found that the vessel had run aground because the skipper had not set waypoints on 
the GPS equipment but had instead been using the cursor on one of the GPS plotters to keep an informal note of 
course and position. 

Before reviewing hazards that can arise during interaction with GPS technology in more detail, it is first important to 
summarise the benefits that these applications provide to their users. The problems that complicate interaction with 
these systems often stem from the operational features that provide the greatest utility under normal operations. As 
noted in the previous citation, the accuracy and availability of GPS data can lead to an over reliance that leaves users 
unprepared to cope when these systems fail. The following list summarises further benefits of positioning 
technology. Subsequent sections use this list, together with an analysis of previous accidents to identify many of 
the problems that arise during the use of these systems. 

1. Reduced workload. An important benefit of GPS applications is that they can reduce human workload. The 
precise nature of this reduction varies from domain to domain. For example, in many commercial maritime 
systems the data from GPS applications is seen as an adjunct to rather than a replacement for conventional 
manual and radar based navigation techniques. However, as we shall see, in other parts of the world crews 
have come to rely on GPS technology within routine operations so that alternate techniques for location 
identification are only used to supplement GPS readings. In other words, the bulk of routine navigation 
tasks has passed from manual and radar based techniques to the automated satellite information based 
systems. 



2. Reduced uncertainty’. In many applications, navigation is a complex task in which operators have to 
account for subtle changes in meteorological and other environmental conditions. Under poor visibility, it 
can be difficult to account for the influence of varying tides or wind speeds using dead reckoning. In other 
areas, for example in desert or jungle terrains and other remote areas there may be insufficient landmarks or 
radar beacons to easily employ alternate forms of navigation. In such circumstances, GPS tools provide a 
critical means of reducing uncertainty in complex navigation tasks. 

3. Multi-criteria optimisation. GPS tools cannot be viewed in isolation. The position information that they 
provide is, typically, integrated into a wide range of location finding and route planning systems. This 
integration enables complex optimisation tasks to be performed where for example speed can be traded for 
fuel usage or routes can be tailored to avoid congestion. These optimisation tasks would otherwise occupy 
considerable perceptual and cognitive resources if they had to be performed manually. This creates 
significant vulnerabilities when operators must learn to cope with degraded modes of operation [3]. An 
important aspect of multi-criteria optimisation is the manner in which GPS applications can quickly 
compute alternate routes or alter performance characteristics in order to achieve specific objectives in the 
face of rapid and/or immediate changes in an application process or operating environment. For example, 
positioning equipment can automatically monitor the mean speed of its operator over given terrain and then 
adjust routing information to exclude similar areas should they fall behind the predicted schedule. As with 
many of the other benefits identified in this section, it is often infeasible for operators to manually conduct 
the continual forms of self-monitoring that routinely inform route revision algorithms in existing 
applications. 

4. Monitoring of primary systems. GPS systems provide an important means of confirming information that 
can also be derived from primary sensors. For example, it is possible to use successive location fixes to 
compute speed in a range of aviation, ground and maritime applications. Similarly, the influence of tides 
and currents can be inferred by comparison of performance data with location information over time. 
Significant deviations between the GPS derived data and the output of other primary systems can also be 
used to trigger alarms for the crew that warn them of potential failures in either application. 

5. Multiple input mappings. GPS tools can also be used to navigate using a range of different input data. This 
might seem like a trivial issue. However, there are strong benefits to be achieved if crew can choose 
whether or not to specify a route in terms of individual waypoints, physical landmarks, map coordinates or 
even ZIP codes. The difficulty of translating from these navigational reference systems into a single input 
scheme increases burdens on operators especially if they are under time pressure. GPS applications often 
provide considerable flexibility so that information can be entered in a form that is convenient and familiar 
to the end user. 

6. Multiple output mappings. GPS systems also offer considerable flexibility to their users in terms of the 
presentation format of navigational information. They offer a host of two and three dimensional graphical 
displays where map or plan views can be extended to show fly-by simulations of potential routes from or to 
a known location. In other domains, GPS data is used to generate audio alarms so that crew members are 
only alerted when they have moved close to a known danger or away from a recommended course. Audio 
warnings can also be used to provide alerts when there are potential disagreements between primary 
sensors and GPS technology, indicating possible system failures. 

7. Log maintenance. GPS and future location technologies provide increasingly important resources for 
accident investigators. These tools can automatically log location changes over time to a level of 
granularity that is infeasible using manual documentation techniques. In consequence, GPS data is often 
the primary resource for identifying the location of a vessel or aircraft immediately before a mishap 
occurred. From the perspective of system operators, the availability of GPS log functions may be used to 
justify some reduction in the frequency of manual recording. 


This is a partial list. The range of benefits derived from GPS-based navigation will increase in proportion to the 
variety of potential applications. However, these strengths also create potential vulnerabilities. Increasing reliance 



on navigational tools can erode traditional skills and leave operators particularly exposed when they are deprived of 
these components in their underlying infrastructure. 

Incidents and Accidents Involving Interaction with GPS Tools in the Aviation and Maritime Industries 


Marine Accident 1 - The Royal Majesty: Arguably one of the most notorious recent incidents involving interaction 
with GPS applications occurred in 1995 with the grounding of the cruise ship Royal Majesty [4, 5]. The GPS 
receiver on the Royal Majesty provided position data that was accurate to within 100 meters. The crew also had 
access to a Loran-C radio-based navigation system. Loran-C relies on time differences between land based radio 
signals to provide position data along the coasts of the United States. Both GPS and Loran-C data were fed to an 
integrated NACOS 25 autopilot that could be programmed with the vessels performance characteristics using 
waypoints specified in terms of latitude and longitude. The NACOS unit provided a number of operating modes. 
For example, the NAV function could be used to steer the vessel along a pre-programmed track using the GPS and 
other sensor inputs to compensate for gyro error, wind, current and sea conditions. Alternatively, the unit could 
operate in hybrid navigation mode using position data from Loran-C or two other positional systems not based on 
GPS. The unit was also programmed to default to a dead reckoning mode when satellite data were unavailable. 
When the unit switched to dead reckoning mode it was designed to issue a series of warning sounds lasting around a 
second. The unit would also display the letters ‘DR’ indicating the transition into this mode. On the night of the 
accident, all the officers of the watch testified that they did not see ‘DR’ displayed on the unit. They did, however, 
confirm that they understood the meaning of these symbols and had seen them on previous occasions. 

Following the accident it was determined that the vessel lost all contact with satellite based position data around 
thirty minutes after leaving port. The failure was traced back to the antenna assembly; however, there was 
insufficient evidence to accurately identify the cause of the problem. Several hypotheses were generated. The 
GPS antenna had originally been installed on the radar mast. Several months before the accident, it had been moved 
to improve signal reception. Subsequent examinations indicated that the GPS antenna was incorrectly routed so that 
members of the crew could inadvertently kick it or trip over it. This, in turn, created stresses that might contribute 
to the separation of the antenna cable connection. The antenna had also been painted on two occasions. The 
consequence of the antenna failure was that the vessel continued to record alternate courses of 197° and 000° from 
shortly after leaving harbour until the vessel’s arrival in Boston even though it had maintained a course close to 336° 
before the accident. The logs also recorded a speed of 12.7 knots. This was not consistent with the speeds recorded 
manually in the bridge log. In other words, the interruption of the satellite signal placed the navigation unit into dead 
reckoning mode. The autopilot did not detect this change in status and no longer began to correct for the effects of 
wind, current, or sea conditions. As might be expected the actual position began to drift with respect to the location 
indicated through dead reckoning. The effects of an east-north easterly wind and sea resulted in a 17-mile error. 

The previous paragraphs have briefly outlined the technical causes of the GPS failure. In contrast, the focus of this 
paper is on the human factors issues that arose during interaction with the navigation equipment. According to the 
master, he arrived on the bridge around 22:00. After talking with the second officer for several minutes, he checked 
the vessel’s position using the plots on the chart and at a map overlay on the radar display. This system enabled the 
officers to move the radar display to known locations that could be identified from the navigation system. The 
corresponding plots could then be compared for accuracy with the direct radar feeds to the bridge. The master 
asked the second officer whether he had seen the indicated buoy and the second officer stated that he had. Satisfied 
that the positions plotted on the chart and that the map displayed on the radar continued to show the vessel to be 
following its intended track, the master left the bridge around 22:10. 

There were several further opportunities for the crew to identify the potential problem before the grounding took 
place. Other officers on the bridge received reports that the lookouts had sighted several high red lights as well as a 
flashing red light on the port bow. These were inconsistent with the current positional information and should have 
caused the officers to look again at the radar systems. They might then have noticed that the radar maps did not 
coincide with the ARPA display. They might also have increased the range of radar systems and then recognised 
their proximity to Nantucket Island. Had the officers queried the flashing red light, they might have determined that 
the nearest source was the Rose and Crown Shoal buoy. This could have warned them that they were no longer in 
the traffic lanes. The subsequent investigation concluded, however, that the officers of the watch had only a limited 
understanding of the functioning of their GPS units. This was compounded by the way in which procedures failed 
to ensure the use of diverse positional information. For example, the master required that officers continue to make 



manual plots of their location. However, his colleagues used GPS as the most convenient source for this 
information. In consequence, the fixes that were plotted on the chart corresponded with the map and positions 
displayed on the central console. The manual plotting was, therefore, derived from the GPS data. 

The grounding of the Royal Majesty provides an important case study for the analysis in this paper because it 
illustrates many of the problems that complicate interaction with GPS applications. Firstly, like many similar 
systems the vessel was provided with multiple redundant sources of location information. However, this 
redundancy was little more than ‘skin deep’. In practice, the convenience of GPS systems meant that the crew relied 
on this source of data to guide all of their monitoring and validation procedures for navigational information. This 
created further vulnerabilities because different members of the crew each assumed that their co-workers were 
accessing diverse information sources and so felt justified in them continuing only to rely on GPS input. Secondly, 
the Royal Majesty illustrates the dangers that arise when GPS applications are integrated into more complex systems 
that are, typically, not well understood by the people who must operate them. In this case, the master and the 
officers could recognise the dead reckoning mode but they were poorly prepared for the causes and consequences of 
failures that could lead to this style of operation. 

Marine Accident 2 - Sanga Na Langa: The consequences and notoriety of the Royal Majesty accident justify its 
inclusion in this analysis. However, it is important not to overlook a growing number of less well known incidents 
involving interaction with GPS technology that have been reported across a range of industries. For instance, the 
New Zealand maritime agency report on the grounding of the Sange Na Langa, a 13.5 meter commercial passenger 
and fishing vessel operating off Waiheke Island in the Hauraki Gulf, in 2006 (Maritime New Zealand, 2006). In 
common with many other incidents, the skipper was familiar with the area of coast in which the incident occurred. 
In particular, he knew the location of a range of offshore rocks that posed a danger to mariners. These rocks were 
well indicated on the display unit of his GPS application and were indicated at some distance off the starboard side 
of the vessel. The skipper’s sense of wellbeing was increased by his confidence in the GPS, which had been 
installed and calibrated by a friend some six years before. As far as he knew, the unit had also always given him 
accurate readings before, although the unit had previously been repaired by the manufacturer’s agent to correct a 
display fault. He was also using an electronic chart that is widely used in the area where he was operating. 

The skipper reported that he was just about to refer to a paper chart when a lookout identified broken water ahead. 
Approximately ten seconds later, the vessel’s hull and propeller ground over the top of a rock. The bilge pumps 
were able to cope with the subsequent ingress of water and the vessel was successfully beached. The official report 
into the incident concluded that the skipper had broken ‘one of the cardinal rules of navigation namely over reliance 
on GPS data’ [2]. Similarly, the electronic chart came with the warning that it should only be used as a backup to 
official government paper charts and traditional methods of navigation. The day after the accident, the skipper 
observed that the GPS placed the vessel on top of a small island even though they were some distance away from it 
on their homeward journey. This significantly undermined the skipper’s confidence in GPS technology. This 
sudden erosion of trust, which may take many years to establish, also illustrates the central role of human factors 
issues in the operation of new generations of navigation equipment. These devices are becoming so tightly 
embedded within everyday operations that users now rely on them to a degree that was never intended by the 
manufacturers or sanctioned by regulatory authorities. 

The grounding of the Sanga Na Langa is also instinctive because it illustrates some of the problems that arise for 
investigatory agencies when they attempt to diagnose the causes of problems with GPS applications. These systems 
can provide incorrect data for a variety of reasons. GPS assisted groundings are often caused by inaccuracies in 
electronic charts. In this case, the manufacturer’s representatives noted that the position of the rocks as displayed on 
the screen correlated with their position in the government maps. The investigators concluded that ‘it is not 
uncommon for display screens that have been monitoring a vessel’s position whilst stationary, for example whilst 
berthed overnight, to show positions a considerable distance from the vessel’s position’ [2]. 

This incident again illustrates a number of key issues that complicate interaction with GPS systems in safety-related 
domains. The skipper of the Sanga Na Langa was familiar with the area in which they were operating. This seems 
to be a common feature of many similar accidents, but detailed studies would be necessary to provide solid evidence 
that familiarity with a location increases the likelihood of being involved in a GPS related incident. It is possible to 
identify a number of potential explanations for this hypothesised correlation. For instance, if an operator 



understands local hazards then they may be more willing to dismiss them as soon as they can be seen on a GPS 
application without necessarily checking to ensure that the GPS has accurately located those hazards. 

A second issue is the high degree of trust the skipper placed in the reliability and calibration of the GPS application. 
In part, this was justified by his experience of the operational performance of the unit. However, it may also have 
been influenced by the growth of consumer applications for this technology. GPS receivers are increasingly being 
integrated into mass market ‘off the shelf products. The fact that these devices can be bought ‘over the counter’ 
may create the misleading impression that all such receivers are relatively simple systems that can be used safely by 
anyone with minimal training and calibration. That is, it may be relatively easy to lose the distinction in complexity 
between GPS units intended for consumer use and those intended for safety-critical applications. 

Aviation 1- Cessna Floatplane: To help promote the exchange insights and lessons learned from GPS induced 
mishaps across several different safety-critical industries, the following examples focus on interactions with new 
navigation technologies within both commercial and general aviation. It is important to stress that the use of GPS- 
based systems has figured as a contributory cause in both major accidents and in less well publicised incidents. For 
example, the US National Transportation Safety Board (NTSB) describes how the pilot of a Cessna 208 seaplane 
forgot to retract the gear on take off from a runway [8], This version of the aircraft has wheels installed on the 
floats. On approaching the destination the pilot realised that the navigation system was using the position of a 
nearby resort island called Filitheyo rather than the GPS position of the landing site about 2.5 miles (4 km) to the 
north. The captain, therefore, began attempting to correct the GPS co-ordinates for the landing site. 

As he touched the water, the aircraft seemed to ‘spring back’ and the captain recognized that he had left the landing 
gear down. The aircraft flipped onto its back pivoting on its nose and left wing. The subsequent investigation 
identified pilot error as the probable cause of the accident. Contributory factors included a failure to use the 
approved checklist when ensuring that the landing gear was properly raised, a failure to monitor appropriate 
instruments and a failure to pay due attention to aural warnings. The manufacturer responded to the incident by 
changing the aural ‘gear down’ warning to occur at a higher speed, ‘thereby allowing the pilot time to react 
accordingly without distraction during the final approach segment of the flight’ [8]. It was recommended that the 
pilot receive additional relevant training. 

One of the most salient features of this incident is that the recommendations focussed on the retraining of the pilot 
and on minor technical changes in the on-board warning systems for the landing gear. The findings of the 
investigation failed to address the problems that the pilot experienced when interacting with the navigation systems. 
Previous research has identified a broad range of issues that complicate the reprogramming of GPS applications in 
safety related domains [9]. These range from the confusion that often arises over the difference between insertion 
and appending of a waypoint into a list of fixes, to the difficulty of distinguishing between the different modes of 
operation that are provided by these navigation systems. However, the subsequent investigation did not explicitly 
raise this as an area for further concern. 

In other areas of human computer interaction and human factors, there has been a move away from blaming 
operators who experience similar problems during interaction with complex systems. It has been argued that 
retraining users only alleviates the symptoms of an underlying problem but does not address the causes [10]. In 
contrast, greater emphasis has been placed on the need to redesign interactive systems rather than rely on retraining 
to address previous weaknesses in the operation of complex systems. 

A final area of concern focuses on the dual nature of GPS navigation systems. One of the primary reasons for the 
introduction of these applications into safety critical systems has been that they can effectively reduce workload for 
crew members who might otherwise be preoccupied with relatively routine navigation tasks. The floatplane 
incident illustrates that these applications can also increase workload during key stages of flight. In this incident, 
even a relatively minor correction occupied the pilots finite perceptual and cognitive resources to such an extent that 
safety was undermined. 

Aviation 2 - Bamiyan Controlled Flight Into Terrain (CFIT): The second aviation accident forms a contrast to the 
relatively minor incident described in the previous paragraphs, in the same way that the grounding of the fishing 
vessel Sanga Na Langa contrasts with the more serious damage to the cruise liner Royal Majesty. This accident 
occurred in November 2004 when a Constmcciones Aeronauticas Sociedad Anonima C-212-CC (CASA 212) twin- 



engine, turboprop airplane collided with mountainous terrain close to the Bamiyan Valley, near Bamiyan, 
Afghanistan. Several factors increased the significance of this accident. The aircraft was operating under a US 
Department of Defence (DoD) contract. The captain, first officer, and mechanic-certificated passenger, all U.S. 
civilians employed by the operator, and the three military passengers, who were active-duty U.S. Army soldiers, 
received fatal injuries. The airplane was destroyed [11]. 

The subsequent enquiry interviewed the programme site manager who stated that he was not aware if route planning 
was explicitly performed for the mission. The accepted visual flight rules (VFR) flight plan contained destination 
information but did not indicate a specific route. Instead he argued that the pilots tended to follow well known routes 
between specific locations using a combination of GPS fixes and direct visual observations to ensure adequate clearance 
above mountainous terrain. However, analysis of the cockpit voice recorder revealed that in this instance the crew had 
never flown the selected route. The mechanic was also heard to observe that the valley they had chosen to follow was 
not the most direct route. The captain later said that they would ‘just have to see where this leads’. The captain, first 
officer and the mechanic then discussed a topological map, the outside visual references and the coordinates derived 
from their GPS applications. The captain was then heard to remark ‘well normally we’d have time to on a short day 
like this we’d have time to play a little bit do some explorin’ but with those winds cornin’ up I want to [expletive] 
get there as fast as we can. ..with this good visibility ... it’s as easy as pie. You run into somethin’ big you just 
parallel it until you find a way thru [sic]. ...’ [11]. Some time later the mechanic stated ‘I don’t know what we’re 
gunna see, we don’t normally go this route’. The captain replied ‘...all we want is to avoid seeing rock at twelve 
o’clock and the first officer stated ‘Yeah you’re an x-wing fighter star wars man’. The captain then replied ‘You’re 
[expletive] right. This is fun’. 

These informal exchanges continued when a passenger asked the flightcrew about the route of the flight and the 
captain discussed some of their previous mountain flying experiences with the first officer. Shortly afterwards, the 
first officer stated that the ridgeline off to their left had a minimum elevation of approximately 14,000 feet above 
mean sea level. The captain stated that he was trying to find a ‘notch to fly through’, shortly afterwards the 
mechanic asked ‘okay you guys are gunna make this right?’ and the captain replied, “yeah I’m hopin’. Ten seconds 
later, the voice recorder seems to capture a stall warning tone single beep. The captain stated they could execute a 
180° turnaround and instructed the first officer to lower the flaps. A further stall warning occurred and the mechanic 
stated, ‘call off his airspeed for him’. The first officer responded ‘you got ninety five’ shortly before the recording 
ended. 

The subsequent investigation argued that the exchanges captured on the cockpit vice recorder provided important 
insights into the attitude and behaviour of the crew in the immediate run up to the crash. It was suggested that the 
captain and first officer acted ‘unprofessionally’ in deliberately flying a nonstandard route low through the valley for 
fun even though the visibility was ‘outstanding’. The captain’s comment that he ‘wouldn’t have done this if we 
were at gross’ was interpreted to mean that the captain made a conscious decision to fly the airplane in a way that he 
would not have done if the airplane had been at maximum gross weight. 

In this case, the use of navigation equipment was not a direct cause of the mishap. Arguably it played a more 
circumstantial role by increasing crew confidence in their ability to navigate out of the box canyon using visual 
observations and GPS location updates. The provision and accepted use of GPS services formed a key component in 
the foundation that supported the sense of complacency criticised in the NTSB report. This complacency, in turn, 
was constructed on the high degree of trust that many operators place in modern navigation systems. As in previous 
accidents, this element of trust may go far beyond what is advised by manufacturers and designers. It may also lead 
the operators of safety critical systems into situations from which navigation fixes alone may be insufficient to 
ensure the success of complex operations. 

Overview of Human Factors Dangers of GPS Receivers 

We have used two maritime and two aviation accidents to provide a sample of recent mishaps that have arisen 
during operator interaction with GPS technology. These incidents have been deliberately selected to include both 
high profile failures, such as the grounding of the Royal Majesty, as well as lesser known but equally significant and 
informative accidents such as the CFIT involving the Cessna floatplane. We have developed an initial list of 
interaction problems that have occurred in the events leading to adverse events involving GPS related systems: 



1. Increased Workload. GPS applications remove the burdens associated with routine navigation tasks. 
However, many also increase workload when setting up the systems. Additional time must be devoted to 
planning a potential route and then programming appropriate waypoints into the system. Similarly, the 
complexity of interaction with these programmable systems can create significant dangers when operators 
must fix even relatively trivial problems during more critical phases of operation. The pilot of the 
floatplane, for example, may have been unable to appreciate that he was landing on water with the wheels 
extended because he was busy coping with the additional burdens associated with specifying a revised 
destination for the floatplane. 

2. Interruption of Primary Tasks. The failure of navigational systems can create a sudden increase in 
workload for particular crew members during critical phases of a safety related task. Problems may stem 
from the way in which GPS tools can interrupt other non-navigational primary tasks not simply the 
additional workload. These interruptions occur during both normal and degraded modes of operation. 
Arguably there is a possibility that the pilot of the floatplane might have forgotten to raise the landing gear 
even if he had been able to resolve the apparent destination fix issue. Human factors research indicates 
that even temporary distractions can be sufficient to cause slips and lapses in otherwise accurate plans [12]. 
Several recent accident reports have described how crew deliberately chose to turn off the distractions 
created by GPS applications’ alarms [13]. 

3. Hazards of Fail-Silent Modes. The Royal Majesty ran aground because the autopilot and associated GPS 
continued to operate in a limited form of ‘fail silent’ mode based on dead reckoning. Rather than being 
faced with the additional workload involved in solving a GPS failure, the crew continued to operate the 
system as though it were functioning normally when in fact they were receiving increasingly erroneous 
navigation data. This incident, therefore, illustrates the dangers that arise when GPS technology fails but 
does not provide operators with sufficient feedback for them to detect and diagnose the impact of that 
failure upon their tasks. 

4. Over-Reliance on Navigational Data. A common theme across all of the incidents here is the high degree 
of trust operators place in the reliability and accuracy of GPS technology and associated navigation 
systems, even when the specific GPS technology being used may not deliver the full reliability and 
accuracy that GPS makes possible This may relate to the increasing integration of GPS applications in 
mass market consumer products. The rapid rise in integration and use of GPS applications may encourage 
an unwarranted belief in the applications’ reliability and accuracy. This belief, transferred to the context of 
safety-critical systems is unwarranted and unfortunately unquestioned as familiarity may breed 
complacency. It further highlights a lack of understanding around the derivation of GPS information and 
electronic navigation aids. The skipper of the Sanga Na Langa had operated his navigation systems for 
several years without any perceived failures and was extremely surprised when over-reliance on GPS data 
ultimately contributed to the grounding of his vessel. 

5. Lack of Hazard Monitoring and Over-Reliance on GPS Alarms One variation of over reliance on GPS 
applications stems less from the high level of misplaced trust in its accuracy and reliability and more from 
misuse of the alarms provided by these systems. For example, many autopilots enable operators to specify 
when visual and audio alarms are raised as they approach known hazards. This allows crew members to 
devote their attention to other primary tasks rather than monitor the location of potential hazards in their 
environment. 

6. Inaccuracies in Charts and Maps. The investigation conducted into the Sanga Na Langa incident revealed 
further hazards related to the use of interactive navigation systems noting several studies in which the 
accuracy of the associated electronic charts was questionable. Even when operators may be concerned to 
verify the location data provided by GPS applications, they may over rely on the location of hazards 
identified in electronic charts and maps. Many of these data sources were drawn up at a time when these 
technologies were not available and, therefore, may not be as accurate as the fixes that are routinely 
available across many industries. In other words, the widespread availability of accurate navigational aids 
is exposing the inaccuracies in many of the charts and maps that guide the operators of safety-critical 
applications. 



7. Erosion of Traditional Navigational Skills and Practices. A continuing concern in several of the reports 
studied in this paper is that the increasing use of GPS may lead to an erosion of traditional navigation skills 
and practices. This does not simply refer to the users’ ability to make an accurate fix on their position. It 
also stems from a concern that operators do not plan their intended route with the same degree of care when 
using a GPS as opposed to traditional navigation aids. The lack of route planning before the loss of the 
CASA 212 is an example. Greater care might have been taken by the crew had they not been able to rely on 
information from satellite navigation systems. As we have seen, however, the benefits provided by the 
technology are limited and do not address the wide range of operational problems that can arise during 
safety-related operations in unknown terrain. 

This list is not exhaustive as it summarises only the major issues in the particular incidents examined in this paper. It 
seems clear that further problems will arise in the interaction between operators and the increasingly complex 
technologies that are being integrated with GPS and its successors. It is ironic, however, that the rising number of 
these adverse events may still not outweigh the larger number of adverse events that have occurred because 
individuals and teams of co-workers chose NOT to use navigational systems [1]. 

Conclusions and Further Work 


The Global Positioning System uses a network of satellites to calculate the position of a receiver over time. This 
technology has revolutionised a wide range of safety-critical industries and leisure applications ranging from 
commercial fisheries through to mountain running. These systems provide diverse benefits; supplementing the users 
existing navigation skills and reducing the uncertainty that characterises route planning tasks. GPS applications may 
also reduce workload by automating tasks that would otherwise consume finite cognitive and perceptual resources. 
However, the use of these systems has unquestioningly contributed to a number of recent maritime and aviation 
accidents. Users often come to rely on GPS applications to such an extent that they fail to appreciate the 
significance of their own role. The individual is a particularly important component in the overall management of 
the system. When there are faults or errors in any of the systems, including those related systems that use GPS data, 
it is the role and responsibility of the individual to manage the systems and intervene appropriately. Similarly over- 
confidence of users who assume automated warnings will be issued when they stray from an intended route has 
contributed to accidents. This paper has argued that greater attention must be paid to the human factors of GPS 
applications as these technologies are integrated into increasing numbers of safety critical applications. 

This work is timely as GPS applications are increasingly being relied upon as primary navigation systems. 
Standard operating procedures across many industries maintain that staff must not rely solely on these applications, 
only to supplement more traditional manual forms of route planning. The accidents reported in this paper together 
with a host of similar incidents reveal that operational practices may instead be built on the use of GPS with other 
techniques used intermittently to provide additional assurance. It is also important to emphasise the wider impact of 
GPS use on overall system safety. The availability of accurate real-time navigation systems is no longer viewed as 
an additional enhancement to existing operational practices. Instead, these applications can be seen as capacity 
enablers. Users will erode safety margins providing that they can call upon the information provided by GPS 
technology. They will travel faster at closer distances to known hazards. This exposes operators and members of 
the public to even greater hazards when problems do occur with positioning systems. 

Further work is required to improve our understanding of the issues identified here to better prepare individuals and 
teams for the many problems that can arise when interactions with GPS applications are impaired. We have not 
explored the underlying perceptual and cognitive factors that contribute to GPS related incidents and accidents. 
Many accident reports describe the sense of surprise that operators express when they realise that there may have 
been a problem with navigation systems; ‘He will never again depend on GPS data to the same extent again and is 
happy to relate his experience so that other mariners will learn from his mistake’ [2], 
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